An abridged version of this article appeared in Whole Earth 106,
Winter 2001, pages 74-77.

Given a digital image of a person's face, face recognition software
matches it against a database of other images. If any of the stored
images matches closely enough, the system reports the sighting to its
owner. Research on automatic face recognition has been around for
decades, but accelerated in the 1990s. Now it is becoming practical,
and face recognition systems are being deployed on a large scale.

Some applications of automatic face recognition systems are relatively
unobjectionable. Many facilities have good reasons to authenticate
everyone who walks in the door, for example to regulate access to
weapons, money, criminal evidence, nuclear materials, or biohazards.
When a citizen has been arrested for probable cause, it is reasonable
for the police to use automatic face recognition to match a mug
shot of the individual against a database of mug shots of people who
have been arrested previously. These uses of the technology should
be publicly justified, and audits should ensure that the technology
is being used only for proper purposes.

Face recognition systems in public places, however, are a matter for
serious concern. The issue recently came to broad public attention
when it emerged that fans attending the Super Bowl had unknowingly
been matched against a database of alleged criminals, and when the
city of Tampa deployed a face-recognition system in the nightlife
district of Ybor City. But current and proposed uses of face
recognition are much more widespread, as the resources at the end
of this article demonstrate in detail. The time to consider the
acceptability of face recognition in public places is now, before
the practice becomes entrenched and people start getting hurt.

Nor is the problem limited to the scattered cases that have been
reported thus far. As the underlying information and communication
technologies (digital cameras, image databases, processing power,
and data communications) become radically cheaper over the next two
decades, face recognition will become dramatically cheaper as well,
even without assuming major advances in technologies such as image
processing that are specific to recognizing faces. Legal constraints
on the practice in the United States are minimal. (In Europe the
data protection laws will apply, providing at least some basic rights
of notice and correction.) Databases of identified facial images
already exist in large numbers (driver's license and employee ID
records, for example), and new facial-image databases will not be
hard to construct, with or without the knowledge or consent of the
people whose faces are captured. (The images need to be captured
under controlled conditions, but most citizens enter controlled,
video-monitored spaces such as shops and offices on a regular basis.)
It is nearly certain, therefore, that automatic face recognition will
grow explosively and become pervasive unless action is taken now.

I believe that automatic face recognition in public places, including
commercial spaces such as shopping malls that are open to the public,
should be outlawed. The dangers outweigh the benefits. The necessary
laws will not be passed, however, without overwhelming pressure of
public opinion and organizing. To that end, this article presents
the arguments against automatic face recognition in public places,
followed by responses to the most common arguments in favor.

Arguments against automatic face recognition in public places

* The potential for abuse is astronomical. Pervasive automatic
face recognition could be used to track individuals wherever they go.
Systems operated by different organizations could easily be networked
to cooperate in tracking an individual from place to place, whether
they know the person's identity or not, and they can share whatever
identities they do know. This tracking information could be used
for many purposes. At one end of the spectrum, the information could
be leaked to criminals who want to understand a prospective victim's
travel patterns. Information routinely leaks from databases of all
sorts, and there is no reason to believe that tracking databases will
be any different. But even more insidiously, tracking information can
be used to exert social control. Individuals will be less likely to
contemplate public activities that offend powerful interests if they
know that their identity will be captured and relayed to anyone that
wants to know.

* The information from face recognition systems is easily combined
with information from other technologies. Among the many "biometric"
identification technologies, face recognition requires the least
cooperation from the individual. Automatic fingerprint reading, by
contrast, requires an individual to press a finger against a machine.
(It will eventually be possible to identify people by the DNA-bearing
cells that they leave behind, but that technology is a long way
from becoming ubiquitous.) Organizations that have good reasons to
identify individuals should employ whatever technology has the least
inherent potential for abuse, yet very few identification technologies
have more potential for abuse than face recognition. Information
from face recognition systems is also easily combined with so-called
location technologies such as E-911 location tracking in cell phones,
thus further adding to the danger of abuse.

* The technology is hardly foolproof. Among the potential downsides
are false positives, for example that so-and-so was "seen" on a
street frequented by drug dealers. Such a report will create "facts"
that the individual must explain away. Yet the conditions for image
capture and recognition in most public places are far from ideal.
Shadows, occlusions, reflections, and multiple uncontrolled light
sources all increase the risk of false positives. As the database
of facial images grows bigger, the chances of a false match to one of
those images grows proportionally larger.

* Face recognition is nearly useless for the application that has
been most widely discussed since the September 11th attacks on New
York and Washington: identifying terrorists in a crowd. As Bruce
Schneier points out, the reasons why are statistical. Let us assume,
with extreme generosity, that a face recognition system is 99.99
percent accurate. In other words, if a high-quality photograph of
your face is not in the "terrorist watch list" database, then it is
99.99 percent likely that the software will not produce a match when
it scans your face in real life. Then let us say that one airline
passenger in ten million has their face in the database. Now, 99.99
percent probably sounds good. It means one failure in 10,000. In
scanning ten million passengers, however, one failure in 10,000 means
1000 failures -- and only one correct match of a real terrorist. In
other words, 999 matches out of 1000 will be false, and each of those
false matches will cost time and effort that could have been spent
protecting security in other ways. Perhaps one would argue that
1000 false alarms are worth the benefits of one hijacking prevented.
Once the initial shock of the recent attacks wears off, however, the
enormous percentage of false matches will condition security workers
to assume that all positive matches are mistaken. The great cost of
implementing and maintaining the face recognition systems will have
gone to waste. The fact is, spotting terrorists in a crowd is a
needle-in-a-haystack problem, and automatic face recognition is not a
needle-in-a-haystack-quality technology. Hijackings can be prevented
in many ways, and resources should be invested in the measures that
are likely to work.

* Many social institutions depend on the difficulty of putting names
to faces without human intervention. If people could be identified
just from looking in a shop window or eating in a restaurant, it
would be a tremendous change in our society's conception of the
human person. People would find strangers addressing them by name.
Prospective customers walking into a shop could find that their
credit reports and other relevant information had already been pulled
up and displayed for the sales staff before they even inquire about
the goods. Even aside from the privacy invasion that this represents,
premature disclosure of this sort of information could affect the
customer's bargaining position.

* The public is poorly informed about the capabilities of the cameras
that are already ubiquitous in many countries. They usually do not
realize, for example, what can be done with the infrared component
of the captured images. Even the phrase "face recognition" does
not convey how easily the system can extract facial expressions.
It is not just "identity" that can be captured, then, but data that
reaches into the person's psyche. Even if the public is adequately
informed about the capabilities of this year's cameras, software and
data sharing can be improved almost invisibly next year.

* It is very hard to provide effective notice of the presence and
capabilities of cameras in most public places, much less obtain
meaningful consent. Travel through many public places, for example
government offices and centralized transportation facilities,
is hardly a matter of choice for any individual wishing to live
in the modern world. Even in the private sector, many retail
industries (groceries, for example) are highly concentrated, so that
consumers have little choice but to submit to the dominant company's
surveillance practices.

* If face recognition technologies are pioneered in countries where
civil liberties are relatively strong, it becomes more likely that
they will also be deployed in countries where civil liberties hardly
exist. In twenty years, at current rates of progress, it will be
feasible for the Chinese government to use face recognition to track
the public movements of everyone in the country.

Responses to arguments in favor of automatic face recognition
in public places

"The civilized world has been attacked by terrorists. We have
to defend ourselves. It's wartime, and we have to give up some
civil liberties in order to secure ourselves against the danger."

We must certainly improve our security in many areas. I have
said that myself for years. The fallacy here is in the automatic
association between security and restrictions on civil liberties.
Security can be improved in many ways that have no effect on civil
liberties, for example by rationalizing identification systems for
airport employees or training flight attendants in martial arts.
Security can be improved in other ways that greatly improve privacy,
for example by preventing identity theft or replacing Microsoft
products with well-engineered software. And many proposals for
improved security have a minimal effect on privacy relative to
existing practices, for example searching passengers' luggage
properly. The "trade-off" between security and civil liberties,
therefore, is over-rated, and I am surprised by the speed with which
many defenders of freedom have given up any effort to defend the core
value of our society as a result of the terrorist attack.

Once we transcend automatic associations, we can think clearly
about the choices that face us. We should redesign our security
arrangements to protect both security and civil liberties. Among
the many security measures we might choose, it seems doubtful that
we would choose the ones that, like automatic face recognition in
public places, carry astronomical dangers for privacy. At least any
argument for such technologies requires a high standard of proof.

"But the case for face recognition is straightforward. They
were looking for two of the terrorists and had photographs of them.
Face recognition systems in airports would have caught them."

I'm not sure we really know that the authorities had photographs that
were good enough for face recognition, even for those small number
of suspects that they claim to have placed on a terrorist watch list.
But even if we grant the premise, not much follows from it. First,
the fact that the authorities suspected only two of the nineteen
hijackers reminds us that automatic face recognition cannot recognize
a face until it is in the database. Most hijackers are not on lists
of suspected terrorists, and even if those particular hijackers had
been prevented from boarding their planes, seventeen others would have
boarded.

More importantly, security procedures at the Boston airport and
elsewhere were so shoddy, on so many fronts, that a wide variety of
improvements would have prevented the hijackings. If you read the
white paper about the hijackings from the leading face-recognition
company, Visionics, it becomes clear that face recognition is really
being suggested to plug holes in identification systems. Terrorist
watch lists include the terrorists' names, and so automatic face
recognition is only necessary in those cases where the government
possesses high-quality facial photographs of terrorists but does
not know their names (not very common) or where the terrorists carry
falsified identification cards in names that the government does not
know. In fact, some of the terrorists in the recent attacks appear
to have stolen identities from innocent people. The best solution
to this problem is to repair the immensely destructive weaknesses
in identification procedures, for example at state DMV's, that have
been widely publicized for at least fifteen years. If these recent
attacks do not motivate us to fix our identity systems, then we are
truly lost. But if we do fix them, then the role that automatic face
recognition actually plays in the context of other security measures
becomes quite marginal.

That said, from a civil liberties perspective we ought to distinguish
among different applications of face recognition. Those applications
can be arranged along a spectrum. At one end of the spectrum are
applications in public places, for example scanning crowds in shops
or on city streets. Those are the applications that I propose
banning. At the other end of the spectrum are applications that
are strongly bounded by legal due process, for example matching a mug
shot of an arrested person to a database of mug shots of people who
have been arrested in the past. When we consider any applications
of automatic face recognition, we ought to weigh the dangers to civil
liberties against the benefits. In the case of airport security,
the proposed applications fall at various points along the spectrum.
Applications that scan crowds in an airport terminal lie toward
the "public" end of the spectrum; applications that check the validity
of a boarding passenger's photo-ID card by comparing it with the photo
that is associated with that card in a database lies toward the "due
process" end of the spectrum. The dangers of face scanning in public
places (e.g., the tracking of potentially unbounded categories of
individuals) may not apply to applications at the "due process" end of
the scale. It is important, therefore, to evaluate proposed systems
in their specifics, and not in terms of abstract slogans about the
need for security.

"All of the people in our database are wanted criminals. We don't
store any of the images that our cameras capture, except when they
match an image in the database. So the only people who have any cause
for complaint are criminals."

The problems with this argument are numerous:

(1) We have to trust your word that the only people whose images are
stored in the database are wanted criminals, and we have to trust
your word that you throw away all of the images that fail to match
the database.

(2) You don't really know yourself whether all of the people in the
database are criminals. Quality control on those databases is far
from perfect, as the database of "felons" that was used to purge some
Florida counties' electoral rolls in 2000 demonstrated.

(3) Even if the only people in the database today are criminals, the
forces pushing us down a slippery slope of ever-expanding surveillance
are nearly overwhelming. Once the system is established and working,
why don't we add alleged troublemakers who have been ejected from
businesses in the past but have never been convicted of crimes? Then
we could add people with criminal records who have served their time,
people who have been convicted of minor offenses such as shoplifting,
people with court orders to stay away from certain places, prisoners,
parolees, gang members, soldiers, people with court summonses
for minor offenses such as unpaid parking tickets, foreigners
who have outstayed their visas, all foreigners in general, people
with a history of mental illness, people who are wanted as material
witnesses, missing persons, children whose parents are worried about
them, elders whose children are worried about them, parents who are
behind on their child support, employees of the businesses where the
system is operating, rich people who are afraid of being kidnapped,
alcoholics who want to be kept out of bars, and other individuals who
have signed contracts agreeing to be tracked. And once those people
are added, it is then a short step to add many other categories of
people as well.

"In effect you're saying that face recognition won't work,
and that we should ban it because it will work so well. You are
contradicting yourself."

Oh come on. Face recognition will work well enough to be dangerous,
and poorly enough to be dangerous as well.

"Public is public. If someone happens to notice you walking in
the park, you have no grounds for complaint if they decide to tell
someone else where you were. That's all we're doing. You don't have
any reasonable expectation of privacy in a public place, and I have a
free-speech right to communicate factual information about where you
were."

A human being who spots me in the park has the accountability that
someone can spot them as well. Cameras are much more anonymous and
easy to hide. More important is the question of scale. Most people
understand the moral difference between a single chance observation
in a park and an investigator who follows you everywhere you go. The
information collected in the second case is obviously more dangerous.
What is more, custom and law have always recognized many kinds of
privacy in public. For example, the press cannot publish pictures of
most people in personally sensitive situations that have no legitimate
news value. It is considered impolite to listen in on conversations
in public. Pervasive face recognition clearly lies at the morally
most problematic end of this spectrum. The chance of being spotted
is different from the certainty of being tracked.

The phrase "reasonable expectation of privacy" comes from a US Supreme
Court decision. The phrase has been widely criticized as useless,
simply because reasonable expectations of privacy in a situation
can disappear as soon as someone starts routinely invading privacy
in that situation. The problem is an often-exploited ambiguity
in the word "expectation", which can mean either a prediction
(with no logical implication that the world morally ought
to conform to it) or a norm (with no logical implication that the
world actually will conform to it). In arguing in favor
of a ban on automatic face recognition in public places, one is not
arguing for a blanket "right of privacy in public", which would be
unreasonable and impractical. Rather, one is arguing for a right
against technologically mediated privacy invasions of certain types.
Technological mediation is key because of its continuous operation,
standardized results, lack of other legitimate purposes, and rapidly
dropping costs.

The argument about free speech rights is spurious because the proposed
ban is not on the transfer of information, but on the creation of
certain kinds of electronic records. You still have the right to
communicate the same information if you acquire it in other ways.

"Providing proper notice of cameras in public places is easy.
In Europe, many public places are plastered with signs that read
'This area monitored by CCTV'. What is the problem?"

The phrase "This area monitored by CCTV" does not properly convey what
the cameras can do, much less what will be done with the images that
they capture. As cameras and their capabilities become more diverse,
notifications will have to become either more detailed or more vague.
Likewise with the expanding range of potential secondary uses.

"Automatic face recognition is not all bad. It has positive uses.
For example, as the technology gets miniaturized you could put a
device in your glasses to remind you of people's names when you meet
them. No doubt our inventive society will come up with other positive
uses as well. Don't stigmatize the technology as simply a tool of
oppression."

The technology does have positive uses. At the outset I acknowledged
some of the positive uses that don't involve involuntary scanning of
people in public places. The argument is: (1) the positive uses in
public places are outweighed by the dangers, (2) even the positive
uses in public places generally involve scanning people without their
consent, and (3) the positive uses that do involve people's consent
can almost always be done just as well with alternative technologies
that do not lend themselves so easily to abuse.

"You can't outlaw technology. The technology will get out there
anyway."

This same argument, if it made sense, would work against any law.
Outlawing murder doesn't mean that no murders get committed. By
passing laws against murder, society expresses its views of right
and wrong, creates a deterrent, gets people who commit murder off
the street so they'll be less likely to murder again, and makes
murder much more difficult and expensive. Automatic face recognition
in public places is not as bad as murder, but the analogy is clear:
outlawing it would express public disapproval of it and make it harder
than it would be otherwise.

"The real solution is to make sure that everyone is subject to
surveillance. Once society is completely transparent, the powerful
won't be able to use technology for repression, because their
repressive scheming will be under surveillance too."

This scenario is unrealistic and immoral. The powerful by definition
are the ones with the greatest capacity to escape surveillance, and
so even in the greatest possible epidemic of surveillance the powerful
would be the last to succumb. A regime of total surveillance would
itself be extreme repression, and because a large proportion of the
population would resist it, it could only be enforced through extreme
repression. Promising that the repression will be turned against
the powerful as well resembles nothing so much as the repression
of the ruling classes in the French, Russian, and Chinese Revolutions.
I am a democrat and an egalitarian myself, but I recognize that a
generalized repression is the worst way to promote those values.

"Automatic face recognition stops crime. Police say they want it.
By automating some of their more tedious jobs, it will free them to
allocate their limited resources more effectively. And if it prevents
one child from being killed then I support it."

A free society is a society in which there are limits on what the
police can do. If we want to remain a free society then we need
to make a decision. Once a new surveillance technology is installed,
it is nearly impossible to stop the slippery slope toward ever broader
law enforcement use of it. The case of automatic toll collection
makes this clear. Absent clear legal protections, then, we should
assume from the beginning that any technology that captures personal
information will be used for law enforcement purposes, and not only in
cases where lives are immediately at stake. The potential for abuse
should then be figured into our decision about whether the technology
should be deployed at all. That said, it is hardly proven that face
recognition stops crime, when face recognition is being added to a
world that already contains many other crime-fighting technologies.
The range of crime detection technologies available to the police
has grown immensely in recent years, and even if one encountered a
case where a crime was solved using a given technology it by no means
follows that the crime would not have been solved equally well using
some other technology. And even if face recognition causes additional
crimes to be prevented or solved, that effect should be weighed
against the number of additional crimes that abuse of face recognition
makes possible.

"I've been in the military and the police, and if you had seen some of
the things that I've seen then you would change your mind."

You don't know what I've seen. Besides, everyone knows, having been
reminded daily by the news, that evil crimes are committed every day.
The real problem with your argument is that, like the argument I just
addressed, it could be applied to support giving absolute power to
the military and police. But then, by definition, we would no longer
be a free society. We need principled arguments about the place of
government force in a free society, and my purpose here is to suggest
what some of those arguments might be.

"Why are you anti-law enforcement? The only thing that's keeping
you, your families and your property safe is a robust law enforcement
system. Without law enforcement your belongings would be stolen in no
time."

To speak in terms of pro- versus anti-law enforcement is a simplistic
dichotomy. Society should relate to the police the same way that we
relate to the military: of course we need it, but if it becomes the
central organizing principle of our culture then we are in trouble.
It is dangerous to create a government bureaucracy, in this case the
police, and tell it, "your one and only job is to suppress crime, and
to that end we will give you absolutely whatever you ask for". That
is a recipe for authoritarianism, which in the long run is no better
for the police than it is for anyone else. Democracy means reckoning
balances, not choosing between extremes, and the argument here is
simply that one particular technology, automatic face recognition used
in public places, creates such powerful imbalances that a democracy
cannot tolerate it.

"Your arguments are scare tactics. Rather than trying to scare
people with scenarios about slippery slopes, why don't you join in
the constructive work of figuring out how the systems can be used
responsibly?"

The arguments in favor of automatic face recognition in public places
are "scare tactics" too, in that they appeal to our fear of terrorism.
But some fears are justified, and it is reasonable to talk about them.
Terrorism is a justifiable fear, and so is repression by a government
that is given too much power. History is replete with examples of
both. Plenty of precedents exist to suppose that automatic face
recognition, once implemented and institutionalized, will be applied
to ever-broader purposes. The concern about slippery slopes is not
mere speculation, but is based on the very real politics of all of
the many issues to which automatic face recognition could be applied.
My argument here is intended to contribute to the constructive
work of deciding how automatic face recognition can be responsibly used.
It can be responsibly used in contexts where the individuals involved
have been provided with due process protections, and it cannot be
responsibly used in public places. I fully recognize that literally
banning automatic face recognition in public places is a major step.
The reason to ban it, though, is simple: the civil liberties dangers
associated with automatic face recognition are virtually in a class
by themselves.

"Liberty is not absolute. It is reasonable for the government to
curtail liberty to a reasonable degree for the sake of the collective
good."

Certainly so. The question is which curtailments of liberty provide
benefits that are worth the danger. The argument here is simply that
automatic face recognition in public places does not meet that test.

"The technology doesn't create anything new. If the government
wants to follow you around now, they get plain-clothes cops to do it.
The technology may make following you cheaper, but it doesn't make
anything possible that wasn't possible before."

That's true with most information and communication technologies,
which people use to amplify forces that already existed in society.
The argument against automatic face recognition is not that it creates
something qualitatively new, but that it amplifies existing dangers,
such as political repression, beyond a level that a democracy can
tolerate.

"What are you talking about? Your face already is a bar code.
Everyone's face is unique, and people can use your face to recognize
you. That's all the technology does."

Well, obviously, to say that your face is not a bar code is first and
foremost a moral statement. Your face should not be treated as
a bar code. But in fact, you face really is not a bar code. When a
person sees your face, that is different from a machine reading a bar
code because the person who sees your face cannot easily communicate
to a third party what the face they saw looks like. That is why
the police need skilled interviewers with specialized artistic
techniques to recover facial images from eyewitnesses. An automatic
face recognition machine, on the other hand, computes a digital
representation of your face that is easily communicated, compared,
stored, and associated with other information. So the technology
does something more than what people do. If several different people
spot you in several different locations, then they cannot connect
the different sightings unless they all know your name, or they are
all shown a photograph of you, or your appearance is very distinctive
in some way. Even then, the effort required to put the different
sightings together is considerable. Machines can remember identities
in industrial quantities, which people cannot do without special
training, and they can assemble data across great distances much more
quickly and efficiently than people can. The differences between
human and machine face recognition, then, are so extensive that they
cannot be treated as interchangeable.

"The evils that you envision are all speculative. This technology
has not hurt anybody, and you can't go imposing a death sentence on it
without evidence that it's dangerous."

The dramatic improvements in the underlying technology are hardly
speculative. We know what technologies are in the lab, and we
know roughly how long it will take before those technologies reach
the market. We are therefore justified in extrapolating historical
cost trends into the foreseeable future. The capabilities of the
technology in the next couple of decades are hardly in doubt.

Nor can there be much doubt about the potential for abuse. We have
abundant precedents from other technologies, and the burden is really
on the person who would argue that automatic face recognition in
public places will be an exception to these precedents. Databases
will leak, technologies will exhibit function creep, information
will be diverted to secondary uses, law enforcement will make use
of technologies originally designed for other purposes, repressive
governments will make use of technological advances pioneered in
relatively free societies, and people's lives will be disrupted
by quality control problems in the data. The argument here is not
that automatic face recognition in public places will turn society
into Orwell's 1984 overnight, or at all. The harms from
automatic face recognition will develop slowly because the technology
will not be deployed instantaneously, and because institutions change
slowly. But the danger is great enough, and backed up by enough
history and logic, and will be hard enough to reverse if it does
materialize, that we are justified in acting now.

"When an automatic face recognition system produces a match, it is
not the judge, jury, and executioner. If your name comes up wrongly,
you'll be cleared in the same way that you'd be cleared after any
other sort of mistaken identification. Automatic face recognition
may not be perfect, but it's a lot more accurate than identification
by human beings, and I don't see you trying to outlaw that."

As the cost of the underlying technologies drops exponentially, face
recognition systems can easily become pervasive. As that happens, the
number of opportunities for false identification will become pervasive
as well. Identification by people and identification by machine
cannot really be compared anyway because the conditions under which
the police receive identifications from people and from machines are
quite different. People can't easily be programmed to recognize large
numbers of faces of people they have never met. And when a machine
does produce a false match, the reputation of technology for accuracy
will create a greater stigma than would a false identification by
a person. In any event, the potential for false positives would not
be a sufficient argument by itself against automatic face recognition
in public places. Combined with the other strong arguments, it is one
part of a decisive case against them.

"Privacy prevents the marketplace from functioning efficiently.
When a company knows more about you, it can tailor its offerings
more specifically to your needs. Of course if you ask people whether
scary face recognition systems should be banned then they'll say yes.
But you're asking the wrong question. The right question is whether
people are willing to give up information in exchange for something
of value, and most people are."

This is a non sequitur. Few proposals for privacy protection prevent
people from voluntarily handing information about themselves to
companies with which they wish to do business. The problem arises
when information is transferred without the individual's knowledge,
and in ways that might well cause upset or harm if they became known.
What distinguishes automatic face recognition from many other equally
good identification technologies is that it can be used without the
individual's permission (and therefore without the individual having
agreed to any exchange). That is why it should be banned.

"A preoccupation with privacy is corrosive. Democracy requires
people to have public personae, and excessive secrecy is unhealthy."

Privacy does not equal secrecy. Privacy means that an individual has
reasonable control over what information is made public, and what is
not. Any decent social order requires that individuals be entrusted
with this judgement. Even if particular individuals choose to become
secretive in a pathological way, forcing them to change will not help
the situation and is intrinsincally wrong anyway. As to the value of
public personae, we should encourage the development of technologies
that give people the option to appear publicly where and how they want.

"What do you have to hide?"

This line is used against nearly every attempt to protect personal
privacy, and the response in each case is the same. People have lots
of valid reasons, personal safety for example, to prevent particular
others from knowing particular information about them. Democracy only
works if groups can organize and develop their political strategies
in seclusion from the government and from any established interests
they might be opposing. This includes, for example, the identities of
people who might travel through public places to gather for a private
political meeting. In its normal use, the question "What do you have
to hide?" stigmatizes all personal autonomy as anti-social. As such
it is an authoritarian demand, and has no place in a free society.